2021 CVEs (page 141)
Page 141 of 226 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-23421 | Medium | 5.6 | 2021-08-11 | All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function. |
CVE-2021-3050 | High | 8.8 | 2021-08-11 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to… |
CVE-2021-3048 | Medium | 5.9 | 2021-08-11 | Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding. This condition causes subs… |
CVE-2021-3047 | Medium | 4.2 | 2021-08-11 | A cryptographically weak pseudo-random number generator (PRNG) is used during authentication to the Palo Alto Networks PAN-OS web interface. This enables an au… |
CVE-2021-3046 | Medium | 6.8 | 2021-08-11 | An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user… |
CVE-2021-3045 | Medium | 4.9 | 2021-08-11 | An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file… |
CVE-2021-38549 | Medium | 5.9 | 2021-08-11 | MIRACASE MHUB500 USB splitters through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote att… |
CVE-2021-38548 | Medium | 5.9 | 2021-08-11 | JBL Go 2 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor… |
CVE-2021-38547 | Medium | 5.9 | 2021-08-11 | Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-o… |
CVE-2021-38546 | Medium | 5.9 | 2021-08-11 | CREATIVE Pebble devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical s… |
CVE-2021-38545 | Medium | 5.9 | 2021-08-11 | Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote… |
CVE-2021-38544 | Medium | 5.9 | 2021-08-11 | Sony SRS-XB33 and SRS-XB43 devices through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electr… |
CVE-2021-38543 | Medium | 5.9 | 2021-08-11 | TP-Link UE330 USB splitter devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote… |
CVE-2021-20427 | High | 7.5 | 2021-08-11 | IBM Security Guardium 11.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 19… |
CVE-2021-20420 | Medium | 4.3 | 2021-08-11 | IBM Security Guardium 11.2 could disclose sensitive information due to reliance on untrusted inputs that could aid in further attacks against the system. IBM X… |
CVE-2021-20418 | Critical | 9.8 | 2021-08-11 | IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts… |
CVE-2021-34640 | Medium | 6.1 | 2021-08-11 | The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file… |
CVE-2021-32947 | High | 7.8 | 2021-08-11 | FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. |
CVE-2021-32939 | High | 7.8 | 2021-08-11 | FATEK Automation FvDesigner, Versions 1.5.88 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to craft a… |
CVE-2021-32931 | High | 7.8 | 2021-08-11 | An uninitialized pointer in FATEK Automation FvDesigner, Versions 1.5.88 and prior may be exploited while the application is processing project files, allowing… |
CVE-2021-23420 | High | 7.7 | 2021-08-11 | This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary… |
CVE-2021-0196 | High | 7.8 | 2021-08-11 | Improper access control in kernel mode driver for some Intel(R) NUC 9 Extreme Laptop Kits before version 2.2.0.20 may allow an authenticated user to potentiall… |
CVE-2021-0160 | High | 7.8 | 2021-08-11 | Uncontrolled search path in some Intel(R) NUC Pro Chassis Element AverMedia Capture Card drivers before version 3.0.64.143 may allow an authenticated user to p… |
CVE-2021-0084 | High | 7.8 | 2021-08-11 | Improper input validation in the Intel(R) Ethernet Controllers X722 and 800 series Linux RMDA driver before version 1.3.19 may allow an authenticated user to p… |
CVE-2021-0083 | Medium | 4.4 | 2021-08-11 | Improper input validation in some Intel(R) Optane(TM) PMem versions before versions 1.2.0.5446 or 2.2.0.1547 may allow a privileged user to potentially enable… |
CVE-2021-0062 | High | 7.8 | 2021-08-11 | Improper input validation in some Intel(R) Graphics Drivers before version 27.20.100.8935 may allow an authenticated user to potentially enable escalation of p… |
CVE-2021-0061 | High | 7.8 | 2021-08-11 | Improper initialization in some Intel(R) Graphics Driver before version 27.20.100.9030 may allow an authenticated user to potentially enable escalation of priv… |
CVE-2021-0012 | Medium | 5.5 | 2021-08-11 | Use after free in some Intel(R) Graphics Driver before version 27.20.100.8336, 15.45.33.5164, and 15.40.47.5166 may allow an authenticated user to potentially… |
CVE-2021-0009 | Medium | 6.5 | 2021-08-11 | Out-of-bounds read in the firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow an unauthenti… |
CVE-2021-0008 | Medium | 4.4 | 2021-08-11 | Uncontrolled resource consumption in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow pr… |
CVE-2021-0007 | Medium | 4.4 | 2021-08-11 | Uncaught exception in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.1.0 may allow a privileged atta… |
CVE-2021-0006 | Medium | 4.4 | 2021-08-11 | Improper conditions check in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.4.0 may allow a privileg… |
CVE-2021-0005 | Medium | 4.4 | 2021-08-11 | Uncaught exception in firmware for Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a privileged user… |
CVE-2021-0004 | Medium | 4.4 | 2021-08-11 | Improper buffer restrictions in the firmware of Intel(R) Ethernet Adapters 800 Series Controllers and associated adapters before version 1.5.3.0 may allow a pr… |
CVE-2021-0003 | Medium | 5.5 | 2021-08-11 | Improper conditions check in some Intel(R) Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially e… |
CVE-2021-0002 | High | 7.1 | 2021-08-11 | Improper conditions check in some Intel(R) Ethernet Controllers 800 series Linux drivers before version 1.4.11 may allow an authenticated user to potentially e… |
CVE-2021-33595 | Low | 3.5 | 2021-08-11 | A address bar spoofing vulnerability was discovered in Safe Browser for iOS. Showing the legitimate URL in the address bar while loading the content from other… |
CVE-2021-33594 | Low | 3.5 | 2021-08-11 | An address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafted a malicious URL, it appears like a le… |
CVE-2021-38539 | Medium | 6.3 | 2021-08-11 | Certain NETGEAR devices are affected by privilege escalation. This affects D8500 before 1.0.3.44, R6400v2 before 1.0.2.66, R6700 before 1.0.2.6, R6700v3 before… |
CVE-2021-38538 | Medium | 6.3 | 2021-08-11 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 before 1.0.4.26, R9000 before 1.0.4.26, RA… |
CVE-2021-38537 | Medium | 4.2 | 2021-08-11 | Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R… |
CVE-2021-38536 | Medium | 4.3 | 2021-08-11 | Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R… |
CVE-2021-38535 | Medium | 4.3 | 2021-08-11 | Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R… |
CVE-2021-38534 | Medium | 4.1 | 2021-08-11 | Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6100 before 1.0.0.60, D6200 before 1.1.00.36, D… |
CVE-2021-38533 | Medium | 5.4 | 2021-08-11 | NETGEAR RAX40 devices before 1.0.3.64 are affected by stored XSS. |
CVE-2021-38532 | Medium | 6.8 | 2021-08-11 | NETGEAR WAC104 devices before 1.0.4.15 are affected by incorrect configuration of security settings. |
CVE-2021-38531 | Medium | 4.7 | 2021-08-11 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before… |
CVE-2021-38530 | Critical | 9.6 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 befo… |
CVE-2021-38529 | High | 8.3 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 befo… |
CVE-2021-38528 | Critical | 9.6 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D8500 before 1.0.3.58, R6900P before 1.3.2.132, R7000P b… |
CVE-2021-38527 | High | 8.1 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.14, EX6100v2 before 1.0.1.98, EX6150v… |
CVE-2021-38526 | Medium | 4.3 | 2021-08-11 | Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX35 before 1.0.3.94, RAX38 before 1.0.3.94, and RAX40… |
CVE-2021-38525 | Medium | 6.8 | 2021-08-11 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D620… |
CVE-2021-38524 | Medium | 4.5 | 2021-08-11 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects MK62 before 1.0.6.110, MR60 before 1.0.6.110, MS60… |
CVE-2021-38523 | Medium | 6.9 | 2021-08-11 | NETGEAR R6400 devices before 1.0.1.70 are affected by a stack-based buffer overflow by an authenticated user. |
CVE-2021-38522 | Medium | 6.8 | 2021-08-11 | NETGEAR R6400 devices before 1.0.1.52 are affected by a stack-based buffer overflow by an authenticated user. |
CVE-2021-38521 | Medium | 6.1 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.50, R7900P before 1.4.1.50, R8000P before 1… |
CVE-2021-38520 | Medium | 6.6 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.52, R6400v2 before 1.0.4.84, R6700v3 before… |
CVE-2021-38519 | Medium | 6.3 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6250 before 1.0.4.36, R6300v2 before 1.0.4.36, R6400 before 1… |
CVE-2021-38518 | High | 8.4 | 2021-08-11 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RAX200 before 1.0.4.120, RAX75 before 1.0.4.120, RAX80 before… |
CVE-2021-38517 | Medium | 6.9 | 2021-08-11 | Certain NETGEAR devices are affected by out-of-bounds reads and writes. This affects R6400 before 1.0.1.70, RAX75 before 1.0.4.120, RAX80 before 1.0.4.120, and… |
CVE-2021-38516 | Critical | 10.0 | 2021-08-11 | Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before… |
CVE-2021-38515 | High | 7.4 | 2021-08-11 | Certain NETGEAR devices are affected by denial of service. This affects R6400v2 before 1.0.4.98, R6700v3 before 1.0.4.98, R7900 before 1.0.3.18, and R8000 befo… |
CVE-2021-38514 | Low | 2.4 | 2021-08-11 | Certain NETGEAR devices are affected by authentication bypass. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6100 before 1.0.0.63, D6200 before 1… |
CVE-2021-38513 | Critical | 9.6 | 2021-08-11 | Certain NETGEAR devices are affected by authentication bypass. This affects RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, CBR40 be… |
CVE-2021-32122 | Critical | 9.8 | 2021-08-11 | Certain NETGEAR devices are affected by CSRF. This affects EX3700 before 1.0.0.90, EX3800 before 1.0.0.90, EX6120 before 1.0.0.64, and EX6130 before 1.0.0.44. |
CVE-2021-38512 | High | 7.5 | 2021-08-10 | An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential d… |
CVE-2021-38511 | High | 7.5 | 2021-08-10 | An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via… |
CVE-2021-29400 | Medium | 6.5 | 2021-08-10 | A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of… |
CVE-2021-20032 | Critical | 9.8 | 2021-08-10 | SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potentially leads to R… |
CVE-2021-38490 | High | 7.5 | 2021-08-10 | Altova MobileTogether Server before 7.3 SP1 allows XML exponential entity expansion, a different vulnerability than CVE-2021-37425. |
CVE-2021-37425 | Critical | 9.1 | 2021-08-10 | Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogether… |
CVE-2021-37391 | Medium | 5.4 | 2021-08-10 | A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/… |
CVE-2021-37390 | Medium | 6.1 | 2021-08-10 | A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature). |
CVE-2021-37389 | Medium | 6.1 | 2021-08-10 | Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter. |
CVE-2021-33708 | High | 8.8 | 2021-08-10 | Due to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges. |
CVE-2021-29296 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be… |
CVE-2021-29295 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via usr/bin/lighttpd. I… |
CVE-2021-29294 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK_1.01, which could let a remove malicious user cause a denial of service via the send_hnap_… |
CVE-2021-28846 | Medium | 6.5 | 2021-08-10 | A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a rem… |
CVE-2021-28845 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could… |
CVE-2021-38387 | High | 7.5 | 2021-08-10 | In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting foreve… |
CVE-2021-38386 | High | 7.5 | 2021-08-10 | In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is mishandled when a direct… |
CVE-2021-28844 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03 by sending t… |
CVE-2021-28843 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03 by sending t… |
CVE-2021-28842 | High | 7.5 | 2021-08-10 | Null Pointer Deference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could l… |
CVE-2021-28841 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a… |
CVE-2021-21601 | High | 8.8 | 2021-08-10 | Dell EMC Data Protection Search, 19.4 and prior, and IDPA, 2.6.1 and prior, contain an Information Exposure in Log File Vulnerability in CIS. A local low privi… |
CVE-2021-21600 | Medium | 6.5 | 2021-08-10 | Dell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. An authorized API user could potentially exploit this… |
CVE-2021-21598 | Low | 3.9 | 2021-08-10 | Dell Wyse ThinOS, versions 9.0, 9.1, and 9.1 MR1, contain a Sensitive Information Disclosure Vulnerability. An authenticated attacker with physical access to t… |
CVE-2021-21597 | High | 7.2 | 2021-08-10 | Dell Wyse ThinOS, version 9.0, contains a Sensitive Information Disclosure Vulnerability. An authenticated malicious user with physical access to the system co… |
CVE-2021-21567 | High | 7.8 | 2021-08-10 | Dell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. It may allow an authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PR… |
CVE-2021-38384 | Critical | 9.8 | 2021-08-10 | Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect acces… |
CVE-2021-38383 | Critical | 9.8 | 2021-08-10 | OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c. |
CVE-2021-38382 | Medium | 6.5 | 2021-08-10 | Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and… |
CVE-2021-38381 | Medium | 6.5 | 2021-08-10 | Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daem… |
CVE-2021-38380 | High | 7.5 | 2021-08-10 | Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this t… |
CVE-2021-38140 | Critical | 9.8 | 2021-08-10 | The set_user extension module before 2.0.1 for PostgreSQL allows a potential privilege escalation using RESET SESSION AUTHORIZATION after set_user(). |
CVE-2021-28840 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074… |
CVE-2021-28839 | High | 7.5 | 2021-08-10 | Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, DAP-2660 1.13.RC074… |